Cybersecurity researchers have recently unearthed a new information-stealing malware targeting Apple macOS systems. This malware, named 'Cuckoo' by Kandji, is designed to establish persistence on the infected hosts and function as spyware. Interestingly, Cuckoo is a universal Mach-O binary, capable of running on both Intel- and Arm-based Macs.
The exact distribution vector of this malware remains unclear. However, there are indications that the binary is hosted on websites like dumpmedia[.]com, tunesolo[.]com, fonedog[.]com, tunesfun[.]com, and tunefab[.]com. These sites claim to offer free and paid versions of applications dedicated to ripping music from streaming services and converting it into the MP3 format.
The disk image file downloaded from these websites is responsible for spawning a bash shell to gather host information. It ensures that the compromised machine is not located in Armenia, Belarus, Kazakhstan, Russia, or Ukraine. The malicious binary is executed only if the locale check is successful.
Cuckoo establishes persistence through a LaunchAgent, a technique previously adopted by different malware families like RustBucket, XLoader, JaskaGO, and a macOS backdoor that shares overlaps with ZuRu. Like the MacStealer macOS stealer malware, Cuckoo also leverages osascript to display a fake password prompt to trick users into entering their system passwords for privilege escalation.
According to researchers Adam Kohler and Christopher Lopez, "This malware queries for specific files associated with specific applications, in an attempt to gather as much information as possible from the system." It runs a series of commands to extract hardware information, capture currently running processes, query for installed apps, take screenshots, and harvest data from iCloud Keychain, Apple Notes, web browsers, crypto wallets, and apps like Discord, FileZilla, Steam, and Telegram.
The researchers further noted that "Each malicious application contains another application bundle within the resource directory. All of those bundles (except those hosted on fonedog[.]com) are signed and have a valid Developer ID of Yian Technology Shenzhen Co., Ltd."
The discovery of Cuckoo comes nearly a month after the Apple device management company also exposed another stealer malware codenamed CloudChat that masquerades as a privacy-oriented messaging app and is capable of compromising macOS users whose IP addresses do not geolocate to China.
These findings underscore the importance of maintaining robust cybersecurity measures and staying vigilant about potential threats, especially for macOS users.
